[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

bug#13768: --without-posix code uses scm_getpid() in libguile-2.0.2

From: Mark H Weaver
Subject: bug#13768: --without-posix code uses scm_getpid() in libguile-2.0.2
Date: Sun, 24 Feb 2013 20:17:47 -0500
User-agent: Gnus/5.13 (Gnus v5.13) Emacs/24.2 (gnu/linux)

reopen 13768

Andy Wingo <address@hidden> writes:

> On Wed 20 Feb 2013 00:38, Jan Schukat <address@hidden> writes:
>> What happens is, in random.c in random_state_of_last_resort on line 668
>> scm_getpid is used to seed the random generator. So either a
>> preprocessor switch or a hand constructed scm like in scm_getpid
>> (scm_from_ulong(getpid())) should be used there.
> Fixed, thanks for the report.

This has potential security implications.  If the same program is run
multiple times in the same second, then without something like a PID,
there's a significant danger that two runs of the program will use the
same random seed.

Therefore, I think we ought to try hard to ensure that something like a
PID will always be included in this seed.  Perhaps 'scm_getpid' should
be included even when building --without-posix.

At the very least, the documentation (which currently claims that the
PID is included in the random-state-of-last-resort) should be adjusted
to reflect the new reality.  I just took care of that.


reply via email to

[Prev in Thread] Current Thread [Next in Thread]